diff --git a/.github/CODEOWNERS b/.github/CODEOWNERS
new file mode 100644
index 0000000..66cdce5
--- /dev/null
+++ b/.github/CODEOWNERS
@@ -0,0 +1 @@
+* @bentsku
diff --git a/.github/dependabot.yml b/.github/dependabot.yml
index 19f45c7..906a6e4 100644
--- a/.github/dependabot.yml
+++ b/.github/dependabot.yml
@@ -1,16 +1,38 @@
 version: 2
 updates:
+  # Library deps. `uuid` is the only runtime dependency and ships to consumers
+  # via the git-tag pin, so it is deliberately left out of the group and keeps
+  # its own PR. Majors also stay ungrouped so they can be reviewed individually.
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
+    assignees:
+      - "bentsku"
+    groups:
+      dev-dependencies:
+        dependency-type: "development"
+        update-types: ["minor", "patch"]
 
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "weekly"
+    assignees:
+      - "bentsku"
+    groups:
+      github-actions:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
 
+  # CDK test infrastructure: nothing here reaches consumers, so batch it all.
   - package-ecosystem: "npm"
     directory: "/cdk"
     schedule:
       interval: "weekly"
+    assignees:
+      - "bentsku"
+    groups:
+      cdk:
+        patterns: ["*"]
+        update-types: ["minor", "patch"]
diff --git a/.github/workflows/dependabot-automerge.yml b/.github/workflows/dependabot-automerge.yml
index c569ba9..b7ce057 100644
--- a/.github/workflows/dependabot-automerge.yml
+++ b/.github/workflows/dependabot-automerge.yml
@@ -16,6 +16,7 @@ jobs:
         with:
           github-token: "${{ secrets.GITHUB_TOKEN }}"
       - name: Enable auto-merge for Dependabot PRs
+        if: steps.metadata.outputs.update-type != 'version-update:semver-major'
         run: gh pr merge --auto --squash "$PR_URL"
         env:
           PR_URL: ${{github.event.pull_request.html_url}}